CVE-2026-53799

CVE-2026-53799 affects rsync before 3.5.0. A symlink race between the write to the destination and the subsequent acl_set_file() or lsetxattr() can cause arbitrary ACLs or extended attributes to be applied to unintended files by substituting a symlink at a predictable path, enabling a timing wind...

CVE-2026-53799

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent aclsetfile or...

CVE-2026-53799

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent aclsetfile or...

CVE-2026-53799 rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent aclsetfile or...

CVE-2026-53799 rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent aclsetfile or...

EUVD-2026-58037

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent aclsetfile or...

Kibana 9.4.5 Security Update (ESA-2026-97)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting...

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-126)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models Description: Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly...

CVE-2026-50544

NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at src/platform/windows/misc.cpp lives at C:\ProgramData\LuminalShine\config\apps.json and is created by the SYSTEM service. Under...

PT-2026-71588

Unauthenticated Broken Access Control in Anti Spam and list cleaner AcyChecker = 2.0.0 versions...

PT-2026-71764

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authorization bypass occurs when an authenticated user, authorized to read alerting rules in one Kibana space, can retrieve alerting rule execution telemetry from spaces they are not...

PT-2026-71775

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Missing authorization allows a user with only detection rule authoring privileges for the Elastic Security solution to associate automated endpoint response actions with a detection rule. This...

PT-2026-71783

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An incorrect authorization issue exists where functionality is not properly constrained by Access Control Lists ACLs. This allows an authenticated user with Synthetics write privileges in one...

PT-2026-71637

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A symlink race condition exists where a local attacker can cause the software to apply arbitrary Access Control Lists ACLs or extended attributes to unintended files. This occurs when a symlink is...

PT-2026-71777

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authorization bypass exists where a user can execute unauthorized queries against Elastic Agents assigned to a Kibana space they are not permitted to access. This occurs because functionali...

PT-2026-71905

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxc name parameter to escape container directories...

PT-2026-71903

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write,...

PT-2026-71776

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Missing authorization allows a user capable of authoring and evaluating Elastic Security detection rules to execute Osquery and Elastic Defend response actions on managed hosts. This occurs...

CVE-2026-50544

NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at src/platform/windows/misc.cpp lives at C:\ProgramData\LuminalShine\config\apps.json and is created by the SYSTEM service. Under...

CVE-2026-19016

A flaw was found in Consul. An authenticated caller with network access to the Consul server RPC port could bypass authorization checks. This vulnerability occurs because the system did not enforce the session:write Access Control List ACL permission for session deletion operations submitted...